PRIVACY AND CONFIDENTIALITY POLICY
Mandatory – Quality Area 7
PURPOSE
This policy will provide guidelines:
 for the collection, storage, use, disclosure and disposal of personal information, including photos,
videos and health information at Highvale Preschool
 to ensure compliance with privacy legislation.
POLICY STATEMENT
1. VALUES
Highvale Preschool is committed to:
 Responsible and secure collection and handling of personal information
 Protecting the privacy of each individual's personal information
 Ensuring individuals are fully informed regarding the collection, storage, use, disclosure and
disposal of their personal information, and their access to that information.
2. SCOPE
This policy applies to educators, staff, the committee, students on placement, volunteers,
parents/guardians, children and others attending the programs and activities of Highvale Preschool.
3. BACKGROUND AND LEGISLATION
Background
Early childhood services are obligated by law, service agreements and licensing requirements to
comply with the privacy and health records legislation when collecting personal and health information
about individuals.
The Health Records Act 2001 (Part 1, 7.1) and the Information Privacy Act 2000 (Part 1, 6.1) include a
clause that overrides the requirements of these Acts if they conflict with other Acts or Regulations
already in place. For example, if there is a requirement under the Education and Care Services
National Law Act 2010 or the Education and Care Services National Regulations 2011 that is
inconsistent with the requirements of the privacy legislation, services are required to abide by the
Education and Care Services National Law Act 2010 and the Education and Care Services National
Regulations 2011.
Legislation and standards
Relevant legislation and standards include but are not limited to:
 Education and Care Services National Law Act 2010
 Education and Care Services National Regulations 2011: Regulations 181, 183
 Freedom of Information Act 1982
 Health Records Act 2001 (Vic)
 Information Privacy Act 2000 (Vic)
 National Quality Standard, Quality Area 7: Leadership and Service Management
 Standard 7.3: Administrative systems enable the effective management of a quality service
 Privacy Act 1988 (Cth)
 Public Records Act 1973 (Vic)
Highvale Preschool Association Inc.
October 2014
Privacy and Confidentiality Policy
Page 1 of 12
4. DEFINITIONS
The terms defined in this section relate specifically to this policy. For commonly used terms e.g.
Approved Provider, Nominated Supervisor, Regulatory Authority etc. refer to the General Definitions
section of this manual.
Freedom of Information Act 1982: Legislation regarding access and correction of information
requests.
Health information: Any information or an opinion about the physical, mental or psychological health
or ability (at any time) of an individual.
Health Records Act 2001: State legislation that regulates the management and privacy of health
information handled by public and private sector bodies in Victoria.
Information Privacy Act 2000: State legislation that protects personal information held by Victorian
Government agencies, statutory bodies, local councils and some organisations, such as early
childhood services contracted to provide services for government.
Personal information: Recorded information (including images) or opinion, whether true or not, about
a living individual whose identity can reasonably be ascertained.
Privacy Act 1988: Commonwealth legislation that operates alongside state or territory Acts and
makes provision for the collection, holding, use, correction, disclosure or transfer of personal
information.
Privacy breach: An act or practice that interferes with the privacy of an individual by being contrary to,
or inconsistent with, one or more of the information Privacy Principles (refer to Attachment 2: Privacy
principles in action) or any relevant code of practice.
Public Records Act 1973 (Vic): Legislation regarding the management of public sector documents.
Sensitive information: Information or an opinion about an individual’s racial or ethnic origin, political
opinions, membership of a political party, religious beliefs or affiliations, philosophical beliefs,
membership of a professional or trade association, membership of a trade union, sexual preference or
practices, or criminal record. This is also considered to be personal information.
Unique identifier: A symbol or code (usually a number) assigned by an organisation to an individual
to distinctively identify that individual while reducing privacy concerns by avoiding use of the person's
name.
5. SOURCES AND RELATED POLICIES
Sources
 Child Care Service Handbook 2011–2012: Section 4.9
www.deewr.gov.au/Earlychildhood/Programs/ChildCareforServices/Operation/Documents/CCS_Ha
ndbook.pdf
 Guidelines to the Information Privacy Principles: http://www.privacy.gov.au/law/apply/guidance
 KPV Early Childhood Management Manual
 Office of the Health Services Commissioner: www.health.vic.gov.au/hsc/
 Privacy Victoria: www.privacy.vic.gov.au
Preschool policies
 Child Protection
 Code of Conduct
 Complaints and Grievances
 Delivery and Collection of Children
Highvale Preschool Association Inc.
October 2014
Privacy and Confidentiality Policy
Page 2 of 12
 Enrolment and Orientation
 Information Technology
 Staffing
 Inclusion and Equity
PROCEDURES
The committee is responsible for:
 Ensuring all records and documents are maintained and stored in accordance with Regulations 181
and 183 of the Education and Care Services National Regulations 2011
 Ensuring the preschool complies with the requirements of the Privacy Principles as outlined in the
Health Records Act 2001, the Information Privacy Act 2000 and, where applicable, the Privacy Act
1988 by developing, reviewing and implementing processes and practices that identify:
 what information the preschool collects about individuals, and the source of the information
 why and how the preschool collects, uses and discloses the information
 who will have access to the information
 risks in relation to the collection, storage, use, disclosure or disposal of and access to personal
and health information collected by the service
 Ensuring parents/guardians know why the information is being collected and how it will be managed
 Providing adequate and appropriate secure storage for personal information collected by the
service
 Developing procedures that will protect personal information from unauthorised access
 Ensuring the appropriate use of images of children, including being aware of cultural sensitivities
and the need for some images to be treated with special care
 developing procedures to monitor compliance with the requirements of this policy
 Ensuring all employees and volunteers are provided with a copy of this policy, including the Privacy
Statement of the service (refer to Attachment 4)
 Ensuring all parents/guardians are provided with the service’s Privacy Statement (refer to
Attachment 4) and all relevant forms in their information pack given out at Highvale’s AGM.
 informing parents/guardians that a copy of the complete policy is available on request
 Ensuring a copy of this policy, including the Privacy Statement, is prominently displayed at the
service in Highvale’s Policy Folder and is available on request
 Establishing procedures to be implemented if parents/guardians request that their child’s image is
not be taken, published or recorded, or when a child requests that their photo not be taken.
The Nominated Supervisor is responsible for:
 Assisting the Approved Provider to implement this policy
 Reading and acknowledging they have read the Privacy and Confidentiality Policy (refer to
Attachment 3)
 Ensuring educators and all staff are provided a copy of this policy and that they complete the Letter
of acknowledgement and understanding (Attachment 3)
 Obtaining informed and voluntary consent of the parents/guardians of children who will be
photographed or videoed to be applicable for the entire duration of the year.
Certified Supervisors and other educators are responsible for:
 Reading and acknowledging they have read the Privacy and Confidentiality Policy (refer to
Attachment 3)
 Recording information on children, which must be kept secure and may be requested and viewed
by the child’s parents/guardians and representatives of DEECD during an inspection visit
Highvale Preschool Association Inc.
October 2014
Privacy and Confidentiality Policy
Page 3 of 12
 Ensuring they are aware of their responsibilities in relation to the collection, storage, use, disclosure
and disposal of personal and health information
 Implementing the requirements for the handling of personal and health information, as set out in this
policy
 Respecting parents’ choices about their child being photographed or videoed, and children’s
choices about being photographed or videoed.
Parents/guardians are responsible for:
 Providing accurate information when requested
 Maintaining the privacy of any personal or health information provided to them about other
individuals, such as contact details
Completing all permission forms and returning them to the service in a timely manner
 Being sensitive and respectful to other parent/guardians who do not want their child to be
photographed or videoed
 Being sensitive and respectful of the privacy of other children and families in photographs/videos
when using and disposing of these photographs/videos.
Volunteers and students, while at the service, are responsible for following this policy and its
procedures.
EVALUATION
In order to assess whether the values and purposes of the policy have been achieved, the Approved
Provider of Highvale Preschool will:
 Regularly seek feedback from everyone affected by the policy regarding its effectiveness
 Monitor the implementation, compliance, complaints and incidents in relation to this policy
 Keep the policy up to date with current legislation, research, policy and best practice
 Revise the policy and procedures as part of the preschool’s policy review cycle, or as required
 Notify parents/guardians at least 14 days before making any changes to this policy or its
procedures.
ATTACHMENTS
 Attachment 1: Additional background information
 Attachment 2: Privacy Principles in action
 Attachment 3: Letter of acknowledgment and understanding
 Attachment 4: Privacy Statement
 Attachment 5: Permission form for photographs and videos
AUTHORISATION
This policy was adopted by the Approved Provider of Highvale Preschool on 14th October 2014
REVIEW DATE: OCTOBER 2016
Highvale Preschool Association Inc.
October 2014
Privacy and Confidentiality Policy
Page 4 of 12
ATTACHMENT 1
Additional background information
The preschool must ensure that their processes for the collection, storage, use, disclosure and
disposal of personal and health information meet the requirements of the appropriate privacy
legislation and the Health Records Act 2001.
The following are examples of practices impacted by the privacy legislation:
 Enrolment records: Regulations 160, 161 and 162 of the Education and Care Services National
Regulations 2011 detail the information that must be kept on a child’s enrolment record, including
personal details about the child and the child’s family, parenting orders and medical conditions. This
information is regarded as sensitive information (refer to Definitions) and must be stored securely
and disposed of appropriately.
 Attendance records: Regulation 158 of the Education and Care Services National Regulations 2011
requires details of the date, child’s full name, times of arrival and departure, and signature of the
person delivering and collecting the child or the Nominated Supervisor/educator, to be recorded in
an attendance record kept at the service. Contact details may be kept in a sealed envelope at the
back of the attendance record or separate folder for evacuation/emergency purposes.
 Medication records and incident, injury, trauma and illness records: Regulations 87 and 92 of the
Education and Care Services National Regulations 2011 require the Approved Provider of a service
to maintain incident, injury, trauma and illness records, and medication records which contain
personal and medical information about the child.
 Handling and storage of information: Limited space can often be an issue in early childhood service
environments, and both authorised employees and the Approved Provider need access to secure
storage for personal and health information. It is important that confidential information is not
removed from the service premises at any time, and that folders/files are not accessible to
unauthorised staff or other persons attending the service. This does not include permanent offsite
storage which may be required and used in future years due to limited storage space available at
Highvale Preschool. Any offsite storage used must be in line with the requirements of this policy
and risk management measures completed where required.
 Computerised records: It is important that computerised records containing personal or health
information are stored securely, and can only be accessed by authorised personnel with a
password. Services need to incorporate risk management measures to ensure that passwords are
recorded and stored in a secure place at the service, and to limit access to the information only to
other authorised persons (refer to the Information Technology Policy).
 Forms: Enrolment forms and any other forms used to collect personal or health information should
have the service’s Privacy Statement (refer to Attachment 4) attached.
 Collecting information for which there is no immediate use: A preschool should only collect the
information it needs and for which it has a specific purpose. Preschools should not collect
information that has no immediate use, even though it may be useful in the future.
Highvale Preschool Association Inc.
October 2014
Privacy and Confidentiality Policy
Page 5 of 12
ATTACHMENT 2
Privacy Principles1 in action
1.
Collection processes (Privacy Principle 1)
1.1 Type of personal and health information to be collected
The preschool will only collect the information needed, and for which there is a purpose that is
legitimate and related to the service’s functions and/or obligations.
The type of information collected and held includes (but is not limited to) personal information,
including health information, regarding:
 Children and parents/guardians prior to and during the child’s attendance at a service (this
information is collected in order to provide and/or administer services to children and
parents/guardians)
 Job applicants, employees, members, volunteers and contractors (this information is collected in
order to manage the relationship and fulfil the service’s legal obligations)
 Contact details of other parties that the service deals with.
The preschool will collect information on the following identifiers (refer to Definitions):
 Information required to access the Kindergarten Fee Subsidy for eligible families (refer to Fees
Policy)
 Tax file number for all employees, to assist with the deduction and forwarding of tax to the
Australian Tax Office – failure to provide this would result in maximum tax being deducted
 For childcare services only: Customer Reference Number (CRN) for children attending childcare
services to enable the family to access the Commonwealth Government’s Child Care Benefit (CCB)
– failure to provide this would result in parents/guardians not obtaining the benefit.
1.2 Collection of personal and health information
Personal information about individuals, either in relation to themselves or their children enrolled at the
service, will generally be collected via forms filled out by parents/guardians. Other information may be
collected from job applications, face-to-face interviews and telephone calls. Individuals from whom
personal information is collected will be provided with a copy of the service’s Privacy Statement
(Attachment 4).
When the preschool receives personal information from a source other than directly from the individual
or the parents/guardians of the child concerned, the person receiving the information will notify the
individual or the parents/guardians of the child to whom the information relates of receipt of this
information. The preschool will advise that individual of their right to request access to this information.
Access will be granted in accordance with the relevant legislation. Please note that the legislation
allows the service to deny access in accordance with the limited reasons for denial that are contained
in the legislation (refer to Privacy Principle 6.1).
1.3 Anonymity (Privacy Principle 8)
Wherever it is lawful and practicable, individuals will have the option of not identifying themselves
when entering into transactions with our preschool.
Highvale Preschool Association Inc.
October 2014
Privacy and Confidentiality Policy
Page 6 of 12
2.
Use and disclosure of personal information (Privacy Principle 2)
2.1 Use of information
The preschool will use personal information collected for the primary purpose of collection (refer to the
table below). The service may also use this information for any secondary purposes directly related to
the primary purpose of collection, to which the individual has consented, or could reasonably be
expected to consent. The following table identifies the personal information that will be collected by the
preschool, the primary purpose for its collection and some examples of how this information will be
used.
Personal and health
information collected
in relation to:
Primary purpose of collection:
Examples of how the service will
use personal and health, (including
sensitive) information include:
Children and
parents/guardians
 To enable the service to
provide for the education and
care of the child attending
the service
 Day-to-day administration and
delivery of service
 To promote the service (refer
to Attachments 5 and 6 for
permission forms –
photographs and videos)
 Duty rosters
 Provision of a place for their child in
the service
 Looking after children’s educational,
care and safety needs
 For correspondence with
parents/guardians relating to their
child’s attendance
 To satisfy the service’s legal
obligations and to allow it to
discharge its duty of care
 Visual displays in the service
 Newsletters
 Promoting the service through
external media, including the
service’s website
Committee members
 For the management of the
service
 For communication with and
between committee members,
employees and members of the
association
 To satisfy the preschool’s legal
obligations
Job applicants,
employees,
contractors, volunteers
and students
 To assess and (if necessary)
to engage the applicant,
employees, contractor,
volunteers or students, as
the case may be
 Administering the individual’s
employment, contract or placement,
as the case may be
 To administer the
employment, contract or
placement
 Insurance
Highvale Preschool Association Inc.
October 2014
 Ensuring the health and safety of
the individual
 Promoting the service through
external media, including the
service’s website
Privacy and Confidentiality Policy
Page 7 of 12
2.2 Disclosure of personal information, including health information
The preschool may disclose some personal information held about an individual to:
 Government departments or agencies, as part of its legal and funding obligations
 Local government authorities, in relation to enrolment details for planning purposes
 Organisations providing services related to staff entitlements and employment
 Insurance providers, in relation to specific claims or for obtaining cover
 Law enforcement agencies
 Health organisations and/or families in circumstances where the person requires urgent medical
assistance and is incapable of giving permission
 Anyone to whom the individual authorises the service to disclose information.
2.3 Disclosure of sensitive information (Privacy Principle 10)
Sensitive information (refer to Definitions) will be used and disclosed only for the purpose for which it
was collected or a directly related secondary purpose, unless the individual agrees otherwise, or
where the use or disclosure of this sensitive information is allowed by law.
3.
Storage and security of personal information (Privacy Principle 4)
In order to protect the personal information from misuse, loss, unauthorised access, modification or
disclosure, the committee and staff will ensure that, in relation to personal information:
 Access will be limited to authorised staff, licensee representatives or other committee members who
require this information in order to fulfil their responsibilities and duties
 Information will not be left in areas that allow unauthorised access to that information
 All materials will be physically stored in a secure cabinet or area
 Computerised records containing personal or health information will be stored safely and secured
with a password for access
 There is security in transmission of the information via email, fax or telephone, as detailed below:
1. Emails will only be sent to a person authorised to receive the information
2. Telephone – limited and necessary personal information will be provided over the telephone to
persons authorised to receive that information
 Transfer of information interstate and overseas will only occur with the permission of the person
concerned or their parents/guardians.
4.
Data quality (Privacy Principle 3)
The preschool will endeavour to ensure that the personal information it holds is accurate, complete, up
to date and relevant to its functions and/or activities.
5.
Disposal of information
Personal information will not be stored any longer than necessary.
In disposing of personal information, those with authorised access to the information will ensure that it
is either shredded or destroyed in such a way that the information is no longer accessible.
6.
Access to personal information (Privacy Principle 6)
6.1 Access to information and updating personal information
Individuals have the right to ask for access to personal information the service holds about them
without providing a reason for requesting access.
Under the privacy legislation, an individual has the right to:
 Request access to personal information that the service holds about them
 Access this information
Highvale Preschool Association Inc.
October 2014
Privacy and Confidentiality Policy
Page 8 of 12
 Make corrections if they consider the data is not accurate, complete or up to date.
There are some exceptions set out in the Information Privacy Act 2000, where access may be denied
in part or in total. Examples of some exemptions are where:
 The request is frivolous or vexatious
 Providing access would have an unreasonable impact on the privacy of other individuals
 Providing access would pose a serious threat to the life or health of any person
 The preschool is involved in the detection, investigation or remedying of serious improper conduct
and providing access would prejudice that.
6.2 Process for considering access requests
A person may seek access, to view or update their personal or health information:
 If it relates to their child, by contacting the teacher/coordinator
 For all other requests, by contacting the President of the committee.
Personal information may be accessed in the following way:
 View and inspect the information
 Take notes
 Obtain a copy.
Individuals requiring access to, or updating of, personal information should nominate the type of
access required and specify, if possible, what information is required. Requests will be responded to
within 45 days of receiving the request.
Committee and employees will provide access in line with the privacy legislation. If the requested
information cannot be provided, the reasons for denying access will be given in writing to the person
requesting the information.
In accordance with the legislation, the preschool reserves the right to charge for information provided
in order to cover the costs involved in providing that information.
The privacy legislation also provides an individual about whom information is held by the preschool,
the right to request the correction of information that is held. The preschool will respond to the request
within 45 days of receiving the request for correction. If the individual is able to establish to the
preschool’s satisfaction that the information held is incorrect, the preschool will endeavour to correct
the information.
Highvale Preschool Association Inc.
October 2014
Privacy and Confidentiality Policy
Page 9 of 12
ATTACHMENT 3
Letter of acknowledgement and understanding
[PLACE ON PRESCHOOL LETTERHEAD]
Dear [Insert Name],
Re: Privacy and Confidentiality Policy
Please find attached the Highvale Preschool Privacy and Confidentiality Policy, which outlines how the
preschool will meet the requirements of the Victorian Health Records Act 2001 and the Victorian
Privacy Act 2000 (or where applicable, the Privacy Act 1988) in relation to both personal and health
information.
Employees have an important role in assisting the service to comply with the requirements of the
privacy legislation by ensuring they understand and implement the Highvale Preschool Privacy and
Confidentiality Policy. Therefore, all employees are required to read this policy and complete the
attached acknowledgement form.
Please return the completed form by [Date].
Yours sincerely,
[insert staff member name]
[insert staff member role]
(on behalf of the Approved Provider)
Please note: this form will be kept with your individual staff record.
__________________________________________________________________________________
Highvale Preschool
Acknowledgement of reading the Privacy and Confidentiality Policy
I, _________________________________________________ , have received and read the
service’s Privacy and Confidentiality Policy.
Signature: __________________________________________
Date:
__________________________________________
Highvale Preschool Association Inc.
October 2014
Privacy and Confidentiality Policy
Page 10 of 12
HIGHVALE PRESCHOOL ASSOCIATION
(Att 4) - Privacy Statement
Highvale Preschool Information Privacy Collection Statement
We believe your privacy is important.
Highvale has developed a Privacy and Confidentiality Policy that illustrates how we collect, use, disclose, manage and transfer
personal information, including health information. This policy is available on request.
To ensure ongoing funding and licensing, our service is required to comply with the requirements of privacy legislation in
relation to the collection and use of personal information. If we need to collect health information, our procedures are subject to
the Health Records Act 2001.
The reasons for which we generally collect personal information are given in the table below.
Personal information and health information
collected in relation to:
Children and parents/guardians
Committee
Job applicants, employees, contractors, volunteers
and students
Primary purpose for which information will be used:


To enable us to provide for the education and care of the child
attending the service
To manage and administer the service as required


For the management of the service
To comply with relevant legislation requirements

To assess and (if necessary) to engage employees, contractors,
volunteers or students
To administer the individual’s employment, contracts or placement
of students and volunteers

Please note that under relevant privacy legislation, other uses and disclosures of personal information may be permitted, as set
out in that legislation.
Disclosure of personal information, including health information
Some personal information, including health information, held about an individual may be disclosed to:
 Government departments or agencies, as part of our legal and funding obligations
 Local government authorities, for planning purposes
 Organisations providing services related to employee entitlements and employment
 Insurance providers, in relation to specific claims or for obtaining cover
 Law enforcement agencies
 Health organisations and/or families in circumstances where the person requires urgent medical assistance and is incapable
of giving permission
 Anyone to whom the individual authorises us to disclose information.
Laws that require us to collect specific information
The Education and Care Services National Law Act 2010 and the Education and Care Services National Regulations 2011,
Associations Incorporation Act 1981 and employment-related laws and agreements require us to collect specific information
about individuals from time-to-time. Failure to provide the required information could affect:
 A child’s enrolment at the preschool
 A person’s employment with the preschool
 The ability to function as an incorporated association.
Access to information
Individuals about whom we hold personal or health information are able to gain access to this information in accordance with
applicable legislation. The procedure for doing this is set out in our Privacy and Confidentiality Policy, which is available on
request to the Policy Officer or can be viewed in Highvale Preschools policy folder located at the sign in desk.
For information on the Privacy and Confidentiality Policy, please contact the Approved Provider/Nominated Supervisor.
Highvale Preschool Association Inc.
October 2014
Privacy and Confidentiality Policy
Page 11 of 12
Highvale Preschool Association
(Att 5) - Permission form for photographs and videos
Background information
Photographs and videos are now classified as ‘personal information’ under the Information Privacy Act 2000. The purpose of this permission form
is to: Comply with the privacy legislation in relation to all photographs/videos taken at the preschool, whether by the Approved Provider,
Nominated Supervisor, Certified Supervisor, educators, staff, parents/guardians, volunteers or students on placement, enable photographs/videos
of children to be taken as part of the program delivered by the service, whether group photos, videos or photos at special events and excursions
etc. , notify parents/guardians as to who will be permitted to take photographs/videos, where these will be taken and how they will be used.
Photographs/videos taken by staff
Staff at the service may take photographs/videos of children as part of the program. These may be displayed at the preschool, on the preschool’s
website or placed in the service’s publications or promotional material to promote the preschool, or for any other purpose aligned to the service’s
business operations. Some staff may use learning journals in which photographs are included. When the photographs/videos are no longer being
used, the service will destroy them if they are no longer required, or otherwise store them securely at the service. It is important to note that while
the preschool can nominate the use and disposal of photographs they organise, the service has no control over those photographs taken by
parents/guardians of children attending the service program or activity.
Group photographs/videos taken by parents/guardians
Parents/guardians may take group photographs/videos of their own child/children at special service events such as birthdays, excursions and
other activities. Parents must ensure that where the photographs/videos include other children at the preschool they are sensitive to and respectful
of the privacy of those children and families in using and disposing of the photographs/videos.
Photographs taken by a photographer engaged by the service
A photographer may be engaged by the preschool to take individual and/or group photographs of children. Information will be provided in written
form or email to parents/guardians prior to the event, and will include the date and the photographer’s details.
Photographs/videos for use in newspapers, Highvale Preschool’s website and other external
publications
Photographs may be taken of children to appear in any newspaper/media or external publication, including the service’s newsletter, publications
and website.
Photographs/videos taken by students on placement
Students at the preschool may take photographs/videos of children as part of their placement requirements.
Access to photographs/videos
Access to any photographs or videos, like other personal information, is set out in the preschool’s Privacy and Confidentiality Policy, which is
displayed at the preschool and available on request.
Confirmation of consent
I consent / do not consent to the arrangements for the use of photographs and/or videos, as stated in this permission form for
the entire duration of the year my child is enrolled at Highvale Preschool.
__________________________________
Parent’s/guardian’s name
__________________________________
Signature (parent/guardian)
Highvale Preschool Association Inc.
October 2014
__________________________________
Child’s name
__________________________________
Date
Privacy and Confidentiality Policy
Page 12 of 12